• Rain World: Slugcat Game@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      14 days ago

      hardware is like your computer, stuff like the cpu and ram. software is like the programs on that computer. linus torvalds makes a program that has to deal with the details of the computer (the linux kernel). as such, they have to work around problems in the hardware.

    • teawrecks@sopuli.xyz
      link
      fedilink
      arrow-up
      0
      ·
      14 days ago

      In the last 10 years there has been a seemingly noteworthy uptick in hardware bugs in both intel and amd CPUs. Security researchers find and figure out potential attack vectors that rely on these bugs (ex. Specter/Meltdown). Then operating systems have to put workarounds in their kernel code to ensure that these hypothetical attack vectors are accounted for, at the cost of performance and more complicated code.

      Linus is saying how annoyed he is with all this extra work they have to do, resulting in worse performance, all to plug vulnerabilities that we’ve never actually seen any real attackers use. He’s saying instead we should just write the code how it should be, and if the hardware is insecure, let it be the hardware company’s problem when customers don’t use the hardware.

      The problem is, customers will continue to use the hardware and companies who need a secure OS (all of them) will opt to not use Linux if it doesn’t plug these holes.

      • Kissaki@programming.dev
        link
        fedilink
        English
        arrow-up
        0
        ·
        13 days ago

        we should just write the code how it should be

        Notably, that’s not what he says. He didn’t say in general. He said “for once, [after this already long discussion], let’s push back here”. (Literally “this time we push back”)

        who need a secure OS (all of them) will opt to not use Linux if it doesn’t plug these holes

        I’m not so sure about that. He’s making a fair assessment. These are very intricate attack vectors. Security assessment is risk assessment either way. Whether you’re weighing a significant performance loss against low risk potentially high impact attack vectors or assess the risk directly doesn’t make that much of a difference.

        These are so intricate and unlikely to occur, with other firmware patches in line, or alternative hardware, that there’s alternative options and acceptable risk.

      • ikidd@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        ·
        13 days ago

        Plus a lot of these bugs don’t get fixed, because they exist to allow the processors to “look ahead” for improved performance, at least on unmitigated benchmark tests.

    • FizzyOrange@programming.dev
      link
      fedilink
      arrow-up
      0
      ·
      13 days ago

      This is about Spectre, not about buggy hardware implementations.

      Spectre is a fundamental flaw in speculative execution that means it can leak information, so it’s a security vulnerability. Apparently Intel has been imposing draconian requirements on software to work around the issue rather than fixing it in hardware, which is obviously what they should do, but is not at all trivial.

  • luckystarr@feddit.org
    link
    fedilink
    Deutsch
    arrow-up
    0
    ·
    14 days ago

    He’s not the only one. Laptops especially seem to crash regularily nowadays, regardless the OS.

    I’d like to see hardware classified by boringness and thus stability.

    • Xanthrax@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      14 days ago

      I’ve never had my laptop crash unless I was playing STALKER, GAMMA. What makes your laptop crash? I’m not doubting you, I’m just curious.

        • jerakor@startrek.website
          link
          fedilink
          arrow-up
          0
          ·
          14 days ago

          Every security feature ever made has basically started by absolutely dumping on S3 recovery. S3 recovery requires every device in the computer to give you a complete understanding of how to bring it up cold without engaging the boot flow. Sometimes devices don’t do this because they are lazy, other times they don’t do this for security reasons.

    • tekato@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      13 days ago

      That’s not what this is about. He’s complaining about hardware developers putting more work on kernel developers by making them patch all the CPU vulnerabilities that are introduced by trying to increase performance.

  • mlg@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    12 days ago

    I believe he was also worried people developing RISCV would make similar mistakes which would slow down adoption.

  • jerakor@startrek.website
    link
    fedilink
    arrow-up
    0
    arrow-down
    1
    ·
    edit-2
    14 days ago

    Fully validating hardware is an insane task that hasn’t been really done in years. It would mean 5 years between chip releases and a 2-5X in cost to produce, and people wouldn’t follow the validated configs anyways. If we followed the validated hardware spec we would have 50 min boot times and not go past a 3.5Ghz clock.

    People have the choice today on if they want to run on validated hardware. You can opt in to get a 2.8Ghz part that supports 2666MT/s that is mostly tested and validated, or you can get a 5Ghz part that supports 6000MT/s that is only partially validated. They cost the same price. What do folks think people pick?